v2.0.4

Release 2.0.4

What's New

• The /version endpoint now reports build-time provided capabilities
• The service edge-router list advertises edge router capabilities
• Security fixes (see below)
• Component Updates and Bug Fixes (see below)

Security Advisories

This release addresses one security advisory. See the linked GitHub Security Advisory for full details,
impact, and affected versions.

• GHSA-p6gx-g438-rjc8 (High) - The identity routes handed out the live enrollment
  token and JWT of any identity, including admins. The identity detail and list embed the outstanding
  enrollment, and the identity enrollments subresource applied no scoping, so a non-admin holding only
  identity or enrollment read access could read an admin identity's enrollment secret and redeem it through
  the public enrollment endpoints, minting a certificate or password authenticator on that admin identity
  and escalating to admin. The top level /enrollments routes were already scoped.

Component Updates and Bug Fixes

• github.com/openziti/channel/v4: v4.3.11 -> v4.3.12

  • Issue #295 - closeUnresponsiveTimeout is loaded into checkInterval on the v4 line

• github.com/openziti/edge-api: v0.31.0 -> v0.36.0

  • Issue #198 - Advertise edge router capabilities in the service edge-router list

• github.com/openziti/ziti/v2: v2.0.3 -> v2.0.4

  • Issue #4304 - Support build time provided capabilities in the /version capabilities list
  • Issue #4298 - [Backport-2.0] Bind message with a short cost header panics the router
  • Issue #4264 - [Backport-2.0] Router control-channel connect/disconnect race can leave a reconnected router de-registered
  • Issue #4222 - OIDC cert authentication always reports isCertExtendable as true, including for 3rd Party CA certificates
  • Issue #4118 - Overlapping JWKS kids across ext-jwt-signers cause intermittent primary auth failures (GetIssuerByKid collision)
  • Issue #4094 - Edge router rejects valid first-party client certificates when the edge signing CA differs from the ctrl-channel CA
  • Issue #3914 - [Backport-2.0] ziti login fails against a controller whose server certificate is trusted by the OS trust store. The CA pool now falls back to the OS trust store when no --ca is given, and a stale cached CA is offered for removal
  • Issue #3891 - [Backport-2.0] OIDC auth fails when the controller's server certificate has a wildcard SAN. A wildcard SAN is now expanded to the exact hostnames listed in the new edge-oidc allowedHostnames option, which become valid OIDC issuers